SPLUNK Finding VLAN to VLAN traffic
SPLUNK Finding VLAN to VLAN traffic We are most often concerned with traffic flowing out of the network or into the network. This is where the bad guys start from and most often show their intentions.. But what about the embedded bad guy that is already in your network.. **For what ever reason** Your IDS missed it, or they were already in and then you deployed your IDS... I am talking about internal VLAN traffic, from the Marketing VLAN to the finance VLAN.. that probably shouldnt be happening and we need to watch for it. Assumption: Your internal network numbering is based off of 192.168.0.0/16 So a simple Splunk search would reveal traffic being sourced from internal PC/Laptop hosts to internal PC/Laptop hosts src_ip=192.168.0.0/16 AND dest_ip=192.168.0.0/16 but this ends up with a lot of events that are hard to decipher what is going where and we dont have any "nice" names to determine if an infected Marketing PC is trying to get to the Finance VLAN. In comes splunk look...